New Defects reported by Coverity Scan for LibreOffice

scan-admin at coverity.com scan-admin at coverity.com
Sun Aug 27 02:04:30 UTC 2017


Hi,

Please find the latest report on new defect(s) introduced to LibreOffice found with Coverity Scan.

4 new defect(s) introduced to LibreOffice found with Coverity Scan.
10 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan.

New defect(s) Reported-by: Coverity Scan
Showing 4 of 4 defect(s)


** CID 1416886:  Null pointer dereferences  (FORWARD_NULL)
/sw/qa/extras/ooxmlexport/ooxmlexport9.cxx: 1002 in testWatermarkLayer::verify()()


________________________________________________________________________________________________________
*** CID 1416886:  Null pointer dereferences  (FORWARD_NULL)
/sw/qa/extras/ooxmlexport/ooxmlexport9.cxx: 1002 in testWatermarkLayer::verify()()
996     }
997     
998     DECLARE_OOXMLEXPORT_TEST(testWatermarkLayer, "watermark-layer.docx")
999     {
1000         // Watermark was not visible if page background was set.
1001     
>>>     CID 1416886:  Null pointer dereferences  (FORWARD_NULL)
>>>     Assigning: "pTextDoc" = "dynamic_cast <SwXTextDocument *>(this->mxComponent.get())".
1002         SwXTextDocument* pTextDoc = dynamic_cast<SwXTextDocument*>(mxComponent.get());
1003         SdrPage* pPage = pTextDoc->GetDocShell()->GetDoc()->getIDocumentDrawModelAccess().GetDrawModel()->GetPage(0);
1004         SdrObject* pObject = pPage->GetObj(0);
1005     
1006         CPPUNIT_ASSERT(pObject);
1007         CPPUNIT_ASSERT_EQUAL(static_cast<sal_uInt8>(1), pObject->GetLayer().get());

** CID 1416885:    (NEGATIVE_RETURNS)


________________________________________________________________________________________________________
*** CID 1416885:    (NEGATIVE_RETURNS)
/sc/source/ui/docshell/externalrefmgr.cxx: 2335 in ScExternalRefManager::getRangeNameTokensFromSrcDoc(unsigned short, const ScDocument *, rtl::OUString &)()
2329             switch (pToken->GetType())
2330             {
2331                 case svSingleRef:
2332                 {
2333                     const ScSingleRefData& rRef = *pToken->GetSingleRef();
2334                     OUString aTabName;
>>>     CID 1416885:    (NEGATIVE_RETURNS)
>>>     "rRef->Tab()" is passed to a parameter that cannot be negative.
2335                     pSrcDoc->GetName(rRef.Tab(), aTabName);
2336                     ScExternalSingleRefToken aNewToken(nFileId, svl::SharedString( aTabName),   // string not interned
2337                             *pToken->GetSingleRef());
2338                     pNew->AddToken(aNewToken);
2339                     bTokenAdded = true;
2340                 }
/sc/source/ui/docshell/externalrefmgr.cxx: 2346 in ScExternalRefManager::getRangeNameTokensFromSrcDoc(unsigned short, const ScDocument *, rtl::OUString &)()
2340                 }
2341                 break;
2342                 case svDoubleRef:
2343                 {
2344                     const ScSingleRefData& rRef = *pToken->GetSingleRef();
2345                     OUString aTabName;
>>>     CID 1416885:    (NEGATIVE_RETURNS)
>>>     "rRef->Tab()" is passed to a parameter that cannot be negative.
2346                     pSrcDoc->GetName(rRef.Tab(), aTabName);
2347                     ScExternalDoubleRefToken aNewToken(nFileId, svl::SharedString( aTabName),   // string not interned
2348                             *pToken->GetDoubleRef());
2349                     pNew->AddToken(aNewToken);
2350                     bTokenAdded = true;
2351                 }

** CID 1416884:  Memory - corruptions  (OVERRUN)


________________________________________________________________________________________________________
*** CID 1416884:  Memory - corruptions  (OVERRUN)
/toolkit/source/awt/vclxtoolkit.cxx: 1112 in <unnamed>::VCLXToolkit::ImplCreateWindow(VCLXWindow **, const com::sun::star::awt::WindowDescriptor &, vcl::Window *, long, MessBoxStyle)()
1106                                 if (xSystemDepParent.is())
1107                                 {
1108                                     sal_Int8 processID[16];
1109     
1110                                     rtl_getGlobalProcessId( reinterpret_cast<sal_uInt8*>(processID) );
1111     
>>>     CID 1416884:  Memory - corruptions  (OVERRUN)
>>>     Overrunning array "processID" of 2 8-byte elements by passing it to a function which accesses it at element index 15 (byte offset 120) using argument "16".
1112                                     css::uno::Sequence<sal_Int8> processIdSeq(processID, 16);
1113     
1114                                     css::uno::Any anyHandle = xSystemDepParent->getWindowHandle(processIdSeq, SYSTEM_DEPENDENT_TYPE);
1115     
1116                                     // use sal_Int64 here to accommodate all int types
1117                                     // uno::Any shift operator whill upcast if necessary

** CID 1416883:    (USELESS_CALL)


________________________________________________________________________________________________________
*** CID 1416883:    (USELESS_CALL)
/sw/qa/extras/ooxmlexport/ooxmlexport9.cxx: 955 in testWatermark::verify()()
949     }
950     
951     DECLARE_OOXMLEXPORT_TEST(testWatermark, "watermark-shapetype.docx")
952     {
953         uno::Reference<drawing::XShape> xShape1(getShape(1), uno::UNO_QUERY);
954         uno::Reference<beans::XPropertySet> xPropertySet1(xShape1, uno::UNO_QUERY);
>>>     CID 1416883:    (USELESS_CALL)
>>>     Calling "xShape1.is()" is only useful for its return value, which is ignored.
955         xShape1.is();
956     
957         uno::Reference<drawing::XShape> xShape2(getShape(2), uno::UNO_QUERY);
958         uno::Reference<beans::XPropertySet> xPropertySet2(xShape2, uno::UNO_QUERY);
959         xShape2.is();
960     
/sw/qa/extras/ooxmlexport/ooxmlexport9.cxx: 959 in testWatermark::verify()()
953         uno::Reference<drawing::XShape> xShape1(getShape(1), uno::UNO_QUERY);
954         uno::Reference<beans::XPropertySet> xPropertySet1(xShape1, uno::UNO_QUERY);
955         xShape1.is();
956     
957         uno::Reference<drawing::XShape> xShape2(getShape(2), uno::UNO_QUERY);
958         uno::Reference<beans::XPropertySet> xPropertySet2(xShape2, uno::UNO_QUERY);
>>>     CID 1416883:    (USELESS_CALL)
>>>     Calling "xShape2.is()" is only useful for its return value, which is ignored.
959         xShape2.is();
960     
961         CPPUNIT_ASSERT_EQUAL(xPropertySet1->getPropertyValue("TextAutoGrowHeight"), xPropertySet2->getPropertyValue("TextAutoGrowHeight"));
962     }
963     
964     DECLARE_OOXMLEXPORT_TEST(testActiveXControlAtRunEnd, "activex_control_at_run_end.odt")


________________________________________________________________________________________________________
To view the defects in Coverity Scan visit, https://u2389337.ct.sendgrid.net/wf/click?upn=08onrYu34A-2BWcWUl-2F-2BfV0V05UPxvVjWch-2Bd2MGckcRZBnDJeNb0HijxaS4JNJPxk3kpyAm2AYqo71yXmnOxB72ibeUH-2F-2F1Lhi9AZq3dRu-2F4-3D_g-2BrHdvqzaBa155F-2F8AmPhpJzY63UzWDisJV95WUBpGhqFw1ICExHG8aMaV2EoFpyH-2BZKw3IuR7wum81lcK55yV81mZBFVFWyCZRerkPP7JWuW3qIv-2BOT8vekuGCMwGFZbIm-2FICXlu9FhE-2BM5IP3sHiet5HaU0ZCAHxskgy2hajKdfDTcwy3LrNo-2F3HIlpHlb7AYh-2BB8VYn8XkBZZo0dnxV50a7AulF1TWzFG7fx9T7s-3D

To manage Coverity Scan email notifications for "libreoffice at lists.freedesktop.org", click https://u2389337.ct.sendgrid.net/wf/click?upn=08onrYu34A-2BWcWUl-2F-2BfV0V05UPxvVjWch-2Bd2MGckcRbVDbis712qZDP-2FA8y06Nq4k1FZJSDV-2FTHi5VQof9xGafB4oBwGYxuHHknceo2QLpCrZ44Ciy7AqBR2QyX6OCB5lwWgMDuK-2FivqaohkU3M9kT-2Fww10Qt2GoaCJAOQCa0Wv4ijH4oV8jCt0XXa7QeAwh_g-2BrHdvqzaBa155F-2F8AmPhpJzY63UzWDisJV95WUBpGhqFw1ICExHG8aMaV2EoFpyH-2BZKw3IuR7wum81lcK55yeLabEnxbV1hQVsgal1TmpKMNf1pyNeC6isLFO93QwmmcF24CMGimuEy8LOiqME80vO4E7FtuqhrMHiFkKCisuqV6C3wdjzKtUJYFR7k6MCeyf8ohE8KYGj4xPezKQZ7T3z4TL6fBtwuOhhU3L8tT1s-3D



More information about the LibreOffice mailing list